Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 19:17
Behavioral task
behavioral1
Sample
e486e9a4f70928a10a6a35fd90f36cfc4880f89d4ec07ca16865a62bf6d56105.exe
Resource
win7-20240903-en
General
-
Target
e486e9a4f70928a10a6a35fd90f36cfc4880f89d4ec07ca16865a62bf6d56105.exe
-
Size
50KB
-
MD5
5b8fcc61f01923defa64b4cb5a1e076b
-
SHA1
c230a9f733d13a4a866891abe71c9b1a607d33b1
-
SHA256
e486e9a4f70928a10a6a35fd90f36cfc4880f89d4ec07ca16865a62bf6d56105
-
SHA512
e137519deaf1b5214d440f7c6e645aef952a3cae18d23c6c5583b3c65502de53d24bd796c6a97dd1cc8f8c0b5e35af0073581fa79ef720b1280fe6f326b14ea0
-
SSDEEP
1536:LvQBeOGtrYS3srx93UBWfwC6Ggnouy8g5Uhub:LhOmTsF93UYfwC6GIoutg5Uha
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/684-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/552-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1576-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1276-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4372-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2080-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3872-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3096-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2068-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4252-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3596-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1728-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3148-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3744-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3364-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2036-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2892-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1772-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1572-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1004-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3440-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4724-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2268-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4160-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4840-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3932-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3912-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2960-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1120-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3828-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/928-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2652-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4368-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3876-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2076-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2632-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1724-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3940-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/432-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3612-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4016-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1664-551-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3944-564-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4628-573-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-660-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1872-777-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-893-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7hbntb.exevjdpd.exepddpp.exexrrrfrr.exethhtnh.exedjjdp.exexrrflfx.exehbhhhh.exe7pppd.exepddvp.exerlflfrx.exe3tnhbt.exe3ppdd.exe1jpjv.exefrfxfxx.exevvdvp.exelfrfrlf.exennhtnh.exevjdpd.exejpvvp.exerfflflr.exe9ntbtb.exedjpjd.exejjjjj.exetnnhbb.exebnbnhb.exejjjdj.exerfxlflr.exefxrxrll.exehhttbt.exepjdvv.exerxxrfxx.exe7xrrfff.exe7tttnn.exe7vddd.exexrrlxfx.exe1rrxrlx.exe5ntntn.exevdjvv.exellfxrlf.exexlrllff.exehtnhbt.exe7ppjv.exe7pjdd.exerrfxxrl.exe5thbbb.exepjpvp.exe7flllll.exe9xflxrr.exe5tnnnn.exebttnnn.exe1pjjd.exe3ppjj.exelxffxff.exexrlrxfl.exethnhbb.exe1vddp.exejpdvp.exellllfll.exethbnhb.exe7tthnb.exejvjjd.exejpjdp.exe3xfffll.exepid process 552 7hbntb.exe 1576 vjdpd.exe 4148 pddpp.exe 1276 xrrrfrr.exe 1344 thhtnh.exe 4372 djjdp.exe 2080 xrrflfx.exe 3872 hbhhhh.exe 3096 7pppd.exe 2068 pddvp.exe 5004 rlflfrx.exe 1752 3tnhbt.exe 208 3ppdd.exe 4828 1jpjv.exe 4252 frfxfxx.exe 3596 vvdvp.exe 1728 lfrfrlf.exe 3572 nnhtnh.exe 3328 vjdpd.exe 3508 jpvvp.exe 3148 rfflflr.exe 3744 9ntbtb.exe 3364 djpjd.exe 4932 jjjjj.exe 2036 tnnhbb.exe 2952 bnbnhb.exe 2892 jjjdj.exe 1976 rfxlflr.exe 928 fxrxrll.exe 1608 hhttbt.exe 1772 pjdvv.exe 1572 rxxrfxx.exe 5104 7xrrfff.exe 4368 7tttnn.exe 5096 7vddd.exe 2228 xrrlxfx.exe 1004 1rrxrlx.exe 3440 5ntntn.exe 4948 vdjvv.exe 4884 llfxrlf.exe 4424 xlrllff.exe 2680 htnhbt.exe 4724 7ppjv.exe 2268 7pjdd.exe 2032 rrfxxrl.exe 5040 5thbbb.exe 4272 pjpvp.exe 3216 7flllll.exe 2760 9xflxrr.exe 4428 5tnnnn.exe 2204 bttnnn.exe 2388 1pjjd.exe 4344 3ppjj.exe 2800 lxffxff.exe 4436 xrlrxfl.exe 3484 thnhbb.exe 4160 1vddp.exe 5020 jpdvp.exe 3908 llllfll.exe 2768 thbnhb.exe 4840 7tthnb.exe 3872 jvjjd.exe 2000 jpjdp.exe 3536 3xfffll.exe -
Processes:
resource yara_rule behavioral2/memory/684-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7hbntb.exe upx behavioral2/memory/684-4-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjdpd.exe upx behavioral2/memory/1576-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/552-10-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pddpp.exe upx behavioral2/memory/4148-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1576-18-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrrrfrr.exe upx C:\thhtnh.exe upx behavioral2/memory/1276-25-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djjdp.exe upx C:\xrrflfx.exe upx behavioral2/memory/4372-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2080-39-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbhhhh.exe upx C:\7pppd.exe upx behavioral2/memory/3872-44-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pddvp.exe upx behavioral2/memory/3096-50-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlflfrx.exe upx behavioral2/memory/2068-54-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3tnhbt.exe upx behavioral2/memory/5004-60-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3ppdd.exe upx behavioral2/memory/208-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1jpjv.exe upx C:\frfxfxx.exe upx behavioral2/memory/4828-73-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvdvp.exe upx behavioral2/memory/4252-78-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfrfrlf.exe upx behavioral2/memory/3596-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1728-88-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnhtnh.exe upx C:\vjdpd.exe upx behavioral2/memory/3328-97-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jpvvp.exe upx C:\rfflflr.exe upx behavioral2/memory/3148-106-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9ntbtb.exe upx C:\djpjd.exe upx behavioral2/memory/3744-111-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjjjj.exe upx behavioral2/memory/3364-115-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnnhbb.exe upx C:\bnbnhb.exe upx behavioral2/memory/2036-125-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jjjdj.exe upx behavioral2/memory/2892-134-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rfxlflr.exe upx C:\fxrxrll.exe upx C:\hhttbt.exe upx C:\pjdvv.exe upx behavioral2/memory/1608-147-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxxrfxx.exe upx behavioral2/memory/1772-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1572-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4932-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5096-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1004-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3440-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4948-175-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
hnhbht.exe1pjpj.exe1lfflrx.exerxlfrrx.exexrxrrfr.exevvddd.exeffrlxll.exepdjdv.exetnthbt.exejdpjv.exenhbhht.exexrrlxrl.exehtbthh.exe3rxrfxx.exelrrrlrr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxrfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e486e9a4f70928a10a6a35fd90f36cfc4880f89d4ec07ca16865a62bf6d56105.exe7hbntb.exevjdpd.exepddpp.exexrrrfrr.exethhtnh.exedjjdp.exexrrflfx.exehbhhhh.exe7pppd.exepddvp.exerlflfrx.exe3tnhbt.exe3ppdd.exe1jpjv.exefrfxfxx.exevvdvp.exelfrfrlf.exennhtnh.exevjdpd.exejpvvp.exerfflflr.exedescription pid process target process PID 684 wrote to memory of 552 684 e486e9a4f70928a10a6a35fd90f36cfc4880f89d4ec07ca16865a62bf6d56105.exe 7hbntb.exe PID 684 wrote to memory of 552 684 e486e9a4f70928a10a6a35fd90f36cfc4880f89d4ec07ca16865a62bf6d56105.exe 7hbntb.exe PID 684 wrote to memory of 552 684 e486e9a4f70928a10a6a35fd90f36cfc4880f89d4ec07ca16865a62bf6d56105.exe 7hbntb.exe PID 552 wrote to memory of 1576 552 7hbntb.exe vjdpd.exe PID 552 wrote to memory of 1576 552 7hbntb.exe vjdpd.exe PID 552 wrote to memory of 1576 552 7hbntb.exe vjdpd.exe PID 1576 wrote to memory of 4148 1576 vjdpd.exe pddpp.exe PID 1576 wrote to memory of 4148 1576 vjdpd.exe pddpp.exe PID 1576 wrote to memory of 4148 1576 vjdpd.exe pddpp.exe PID 4148 wrote to memory of 1276 4148 pddpp.exe xrrrfrr.exe PID 4148 wrote to memory of 1276 4148 pddpp.exe xrrrfrr.exe PID 4148 wrote to memory of 1276 4148 pddpp.exe xrrrfrr.exe PID 1276 wrote to memory of 1344 1276 xrrrfrr.exe thhtnh.exe PID 1276 wrote to memory of 1344 1276 xrrrfrr.exe thhtnh.exe PID 1276 wrote to memory of 1344 1276 xrrrfrr.exe thhtnh.exe PID 1344 wrote to memory of 4372 1344 thhtnh.exe djjdp.exe PID 1344 wrote to memory of 4372 1344 thhtnh.exe djjdp.exe PID 1344 wrote to memory of 4372 1344 thhtnh.exe djjdp.exe PID 4372 wrote to memory of 2080 4372 djjdp.exe xrrflfx.exe PID 4372 wrote to memory of 2080 4372 djjdp.exe xrrflfx.exe PID 4372 wrote to memory of 2080 4372 djjdp.exe xrrflfx.exe PID 2080 wrote to memory of 3872 2080 xrrflfx.exe hbhhhh.exe PID 2080 wrote to memory of 3872 2080 xrrflfx.exe hbhhhh.exe PID 2080 wrote to memory of 3872 2080 xrrflfx.exe hbhhhh.exe PID 3872 wrote to memory of 3096 3872 hbhhhh.exe 7pppd.exe PID 3872 wrote to memory of 3096 3872 hbhhhh.exe 7pppd.exe PID 3872 wrote to memory of 3096 3872 hbhhhh.exe 7pppd.exe PID 3096 wrote to memory of 2068 3096 7pppd.exe pddvp.exe PID 3096 wrote to memory of 2068 3096 7pppd.exe pddvp.exe PID 3096 wrote to memory of 2068 3096 7pppd.exe pddvp.exe PID 2068 wrote to memory of 5004 2068 pddvp.exe rlflfrx.exe PID 2068 wrote to memory of 5004 2068 pddvp.exe rlflfrx.exe PID 2068 wrote to memory of 5004 2068 pddvp.exe rlflfrx.exe PID 5004 wrote to memory of 1752 5004 rlflfrx.exe 3tnhbt.exe PID 5004 wrote to memory of 1752 5004 rlflfrx.exe 3tnhbt.exe PID 5004 wrote to memory of 1752 5004 rlflfrx.exe 3tnhbt.exe PID 1752 wrote to memory of 208 1752 3tnhbt.exe 3ppdd.exe PID 1752 wrote to memory of 208 1752 3tnhbt.exe 3ppdd.exe PID 1752 wrote to memory of 208 1752 3tnhbt.exe 3ppdd.exe PID 208 wrote to memory of 4828 208 3ppdd.exe 1jpjv.exe PID 208 wrote to memory of 4828 208 3ppdd.exe 1jpjv.exe PID 208 wrote to memory of 4828 208 3ppdd.exe 1jpjv.exe PID 4828 wrote to memory of 4252 4828 1jpjv.exe frfxfxx.exe PID 4828 wrote to memory of 4252 4828 1jpjv.exe frfxfxx.exe PID 4828 wrote to memory of 4252 4828 1jpjv.exe frfxfxx.exe PID 4252 wrote to memory of 3596 4252 frfxfxx.exe vvdvp.exe PID 4252 wrote to memory of 3596 4252 frfxfxx.exe vvdvp.exe PID 4252 wrote to memory of 3596 4252 frfxfxx.exe vvdvp.exe PID 3596 wrote to memory of 1728 3596 vvdvp.exe lfrfrlf.exe PID 3596 wrote to memory of 1728 3596 vvdvp.exe lfrfrlf.exe PID 3596 wrote to memory of 1728 3596 vvdvp.exe lfrfrlf.exe PID 1728 wrote to memory of 3572 1728 lfrfrlf.exe nnhtnh.exe PID 1728 wrote to memory of 3572 1728 lfrfrlf.exe nnhtnh.exe PID 1728 wrote to memory of 3572 1728 lfrfrlf.exe nnhtnh.exe PID 3572 wrote to memory of 3328 3572 nnhtnh.exe vjdpd.exe PID 3572 wrote to memory of 3328 3572 nnhtnh.exe vjdpd.exe PID 3572 wrote to memory of 3328 3572 nnhtnh.exe vjdpd.exe PID 3328 wrote to memory of 3508 3328 vjdpd.exe jpvvp.exe PID 3328 wrote to memory of 3508 3328 vjdpd.exe jpvvp.exe PID 3328 wrote to memory of 3508 3328 vjdpd.exe jpvvp.exe PID 3508 wrote to memory of 3148 3508 jpvvp.exe rfflflr.exe PID 3508 wrote to memory of 3148 3508 jpvvp.exe rfflflr.exe PID 3508 wrote to memory of 3148 3508 jpvvp.exe rfflflr.exe PID 3148 wrote to memory of 3744 3148 rfflflr.exe 9ntbtb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e486e9a4f70928a10a6a35fd90f36cfc4880f89d4ec07ca16865a62bf6d56105.exe"C:\Users\Admin\AppData\Local\Temp\e486e9a4f70928a10a6a35fd90f36cfc4880f89d4ec07ca16865a62bf6d56105.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\7hbntb.exec:\7hbntb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\vjdpd.exec:\vjdpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\pddpp.exec:\pddpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\xrrrfrr.exec:\xrrrfrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\thhtnh.exec:\thhtnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\djjdp.exec:\djjdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\xrrflfx.exec:\xrrflfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\hbhhhh.exec:\hbhhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\7pppd.exec:\7pppd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\pddvp.exec:\pddvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\rlflfrx.exec:\rlflfrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\3tnhbt.exec:\3tnhbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\3ppdd.exec:\3ppdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\1jpjv.exec:\1jpjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\frfxfxx.exec:\frfxfxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\vvdvp.exec:\vvdvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\lfrfrlf.exec:\lfrfrlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\nnhtnh.exec:\nnhtnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\vjdpd.exec:\vjdpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\jpvvp.exec:\jpvvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\rfflflr.exec:\rfflflr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\9ntbtb.exec:\9ntbtb.exe23⤵
- Executes dropped EXE
PID:3744 -
\??\c:\djpjd.exec:\djpjd.exe24⤵
- Executes dropped EXE
PID:3364 -
\??\c:\jjjjj.exec:\jjjjj.exe25⤵
- Executes dropped EXE
PID:4932 -
\??\c:\tnnhbb.exec:\tnnhbb.exe26⤵
- Executes dropped EXE
PID:2036 -
\??\c:\bnbnhb.exec:\bnbnhb.exe27⤵
- Executes dropped EXE
PID:2952 -
\??\c:\jjjdj.exec:\jjjdj.exe28⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rfxlflr.exec:\rfxlflr.exe29⤵
- Executes dropped EXE
PID:1976 -
\??\c:\fxrxrll.exec:\fxrxrll.exe30⤵
- Executes dropped EXE
PID:928 -
\??\c:\hhttbt.exec:\hhttbt.exe31⤵
- Executes dropped EXE
PID:1608 -
\??\c:\pjdvv.exec:\pjdvv.exe32⤵
- Executes dropped EXE
PID:1772 -
\??\c:\rxxrfxx.exec:\rxxrfxx.exe33⤵
- Executes dropped EXE
PID:1572 -
\??\c:\7xrrfff.exec:\7xrrfff.exe34⤵
- Executes dropped EXE
PID:5104 -
\??\c:\7tttnn.exec:\7tttnn.exe35⤵
- Executes dropped EXE
PID:4368 -
\??\c:\7vddd.exec:\7vddd.exe36⤵
- Executes dropped EXE
PID:5096 -
\??\c:\xrrlxfx.exec:\xrrlxfx.exe37⤵
- Executes dropped EXE
PID:2228 -
\??\c:\1rrxrlx.exec:\1rrxrlx.exe38⤵
- Executes dropped EXE
PID:1004 -
\??\c:\5ntntn.exec:\5ntntn.exe39⤵
- Executes dropped EXE
PID:3440 -
\??\c:\vdjvv.exec:\vdjvv.exe40⤵
- Executes dropped EXE
PID:4948 -
\??\c:\llfxrlf.exec:\llfxrlf.exe41⤵
- Executes dropped EXE
PID:4884 -
\??\c:\xlrllff.exec:\xlrllff.exe42⤵
- Executes dropped EXE
PID:4424 -
\??\c:\htnhbt.exec:\htnhbt.exe43⤵
- Executes dropped EXE
PID:2680 -
\??\c:\7ppjv.exec:\7ppjv.exe44⤵
- Executes dropped EXE
PID:4724 -
\??\c:\7pjdd.exec:\7pjdd.exe45⤵
- Executes dropped EXE
PID:2268 -
\??\c:\rrfxxrl.exec:\rrfxxrl.exe46⤵
- Executes dropped EXE
PID:2032 -
\??\c:\5thbbb.exec:\5thbbb.exe47⤵
- Executes dropped EXE
PID:5040 -
\??\c:\pjpvp.exec:\pjpvp.exe48⤵
- Executes dropped EXE
PID:4272 -
\??\c:\7flllll.exec:\7flllll.exe49⤵
- Executes dropped EXE
PID:3216 -
\??\c:\9xflxrr.exec:\9xflxrr.exe50⤵
- Executes dropped EXE
PID:2760 -
\??\c:\5tnnnn.exec:\5tnnnn.exe51⤵
- Executes dropped EXE
PID:4428 -
\??\c:\bttnnn.exec:\bttnnn.exe52⤵
- Executes dropped EXE
PID:2204 -
\??\c:\1pjjd.exec:\1pjjd.exe53⤵
- Executes dropped EXE
PID:2388 -
\??\c:\3ppjj.exec:\3ppjj.exe54⤵
- Executes dropped EXE
PID:4344 -
\??\c:\lxffxff.exec:\lxffxff.exe55⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe56⤵
- Executes dropped EXE
PID:4436 -
\??\c:\thnhbb.exec:\thnhbb.exe57⤵
- Executes dropped EXE
PID:3484 -
\??\c:\1vddp.exec:\1vddp.exe58⤵
- Executes dropped EXE
PID:4160 -
\??\c:\jpdvp.exec:\jpdvp.exe59⤵
- Executes dropped EXE
PID:5020 -
\??\c:\llllfll.exec:\llllfll.exe60⤵
- Executes dropped EXE
PID:3908 -
\??\c:\thbnhb.exec:\thbnhb.exe61⤵
- Executes dropped EXE
PID:2768 -
\??\c:\7tthnb.exec:\7tthnb.exe62⤵
- Executes dropped EXE
PID:4840 -
\??\c:\jvjjd.exec:\jvjjd.exe63⤵
- Executes dropped EXE
PID:3872 -
\??\c:\jpjdp.exec:\jpjdp.exe64⤵
- Executes dropped EXE
PID:2000 -
\??\c:\3xfffll.exec:\3xfffll.exe65⤵
- Executes dropped EXE
PID:3536 -
\??\c:\htthhh.exec:\htthhh.exe66⤵PID:2964
-
\??\c:\hhhbtb.exec:\hhhbtb.exe67⤵PID:2764
-
\??\c:\ppjjd.exec:\ppjjd.exe68⤵PID:904
-
\??\c:\djvjp.exec:\djvjp.exe69⤵PID:3932
-
\??\c:\5xxxxxx.exec:\5xxxxxx.exe70⤵PID:4920
-
\??\c:\5ntnnn.exec:\5ntnnn.exe71⤵PID:2288
-
\??\c:\xrrrrfl.exec:\xrrrrfl.exe72⤵PID:4616
-
\??\c:\9lllfff.exec:\9lllfff.exe73⤵PID:4252
-
\??\c:\ntbbtt.exec:\ntbbtt.exe74⤵PID:3912
-
\??\c:\hbbnnb.exec:\hbbnnb.exe75⤵PID:1044
-
\??\c:\pjjdj.exec:\pjjdj.exe76⤵PID:4660
-
\??\c:\rfflxxf.exec:\rfflxxf.exe77⤵PID:3572
-
\??\c:\hhnnhn.exec:\hhnnhn.exe78⤵PID:2960
-
\??\c:\9hnhbh.exec:\9hnhbh.exe79⤵PID:3328
-
\??\c:\vdddd.exec:\vdddd.exe80⤵PID:408
-
\??\c:\jpvpj.exec:\jpvpj.exe81⤵PID:4484
-
\??\c:\7lrrffr.exec:\7lrrffr.exe82⤵PID:4460
-
\??\c:\tbhbtn.exec:\tbhbtn.exe83⤵PID:1120
-
\??\c:\3jpjd.exec:\3jpjd.exe84⤵PID:3900
-
\??\c:\fxlfllx.exec:\fxlfllx.exe85⤵PID:3984
-
\??\c:\7lrrxxr.exec:\7lrrxxr.exe86⤵PID:3828
-
\??\c:\tntnnn.exec:\tntnnn.exe87⤵PID:4888
-
\??\c:\9vdvj.exec:\9vdvj.exe88⤵PID:2952
-
\??\c:\7lffrlf.exec:\7lffrlf.exe89⤵PID:2892
-
\??\c:\tbthht.exec:\tbthht.exe90⤵PID:4388
-
\??\c:\vdjvv.exec:\vdjvv.exe91⤵PID:3748
-
\??\c:\ppppp.exec:\ppppp.exe92⤵PID:928
-
\??\c:\lfffrxx.exec:\lfffrxx.exe93⤵PID:4988
-
\??\c:\5xflllr.exec:\5xflllr.exe94⤵PID:2652
-
\??\c:\tbttnn.exec:\tbttnn.exe95⤵PID:3524
-
\??\c:\ttnnhh.exec:\ttnnhh.exe96⤵PID:2992
-
\??\c:\jdjdv.exec:\jdjdv.exe97⤵PID:5104
-
\??\c:\lflxxff.exec:\lflxxff.exe98⤵PID:4368
-
\??\c:\lfffxff.exec:\lfffxff.exe99⤵PID:3876
-
\??\c:\ttbbhh.exec:\ttbbhh.exe100⤵PID:4832
-
\??\c:\jvjjv.exec:\jvjjv.exe101⤵PID:1004
-
\??\c:\pdjjj.exec:\pdjjj.exe102⤵PID:3440
-
\??\c:\jpjdp.exec:\jpjdp.exe103⤵PID:4948
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe104⤵PID:4884
-
\??\c:\hhbbtt.exec:\hhbbtt.exe105⤵PID:436
-
\??\c:\nhnhhn.exec:\nhnhhn.exe106⤵PID:3576
-
\??\c:\vppjd.exec:\vppjd.exe107⤵PID:4728
-
\??\c:\7jpvj.exec:\7jpvj.exe108⤵PID:3288
-
\??\c:\djjjd.exec:\djjjd.exe109⤵PID:2076
-
\??\c:\1frlffx.exec:\1frlffx.exe110⤵PID:4516
-
\??\c:\hhnbbt.exec:\hhnbbt.exe111⤵PID:4280
-
\??\c:\hthnhh.exec:\hthnhh.exe112⤵PID:4352
-
\??\c:\vdpjd.exec:\vdpjd.exe113⤵PID:716
-
\??\c:\7xlfffl.exec:\7xlfffl.exe114⤵PID:1520
-
\??\c:\9rxffff.exec:\9rxffff.exe115⤵PID:2168
-
\??\c:\hbhnhh.exec:\hbhnhh.exe116⤵PID:4428
-
\??\c:\hbnhhn.exec:\hbnhhn.exe117⤵PID:2260
-
\??\c:\dpdjv.exec:\dpdjv.exe118⤵PID:4496
-
\??\c:\3fxlxll.exec:\3fxlxll.exe119⤵PID:2632
-
\??\c:\9xxrrxr.exec:\9xxrrxr.exe120⤵PID:3196
-
\??\c:\bhnhnn.exec:\bhnhnn.exe121⤵PID:3520
-
\??\c:\vjjjd.exec:\vjjjd.exe122⤵PID:1724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-